CVE-2026-42537

CriticalCVSS 9.8

Published: 10/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

29th percentile - higher than 29% of all known CVEs

Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0.

An attacker can exploit JDBC URL injection to execute remote code, potentially leading to system takeover.

Upgrade Apache Ranger to version 2.9.0 or later immediately.

Original NVD description (English source)

Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.